Recovery Planning¶

This template is the starting point for the recovery planning your organization owns for the cloud service offering: the recovery objectives you commit to, the backup and recovery capability that has to meet them, the recovery plan itself, and the testing that proves the capability works. Recovery is executed by your infrastructure and operations teams against your own environment. Fill in the sample sections with your real objectives, mechanisms, and test schedule, then keep the objectives and the plan in step as the offering changes.

Download the KB article (Markdown)

Requirements this document answers¶

All four are Key Security Indicators in the Recovery Planning family. No FedRAMP Rule (FRR) in the 2026 Consolidated Rules names a recovery document; the obligation is the KSI outcome.

"Persistently" is the operative word in all four: each of these is a standing review or test, not a one-time exercise. Set a cadence in the Organization-Defined Values table and hold it.

Sample practice: recovery objectives¶

Sample text. [Organization] defines recovery objectives per service tier. Tier 1 services, which carry federal customer data in the production path, hold an RTO of [duration] and an RPO of [duration]. Tier 2 services hold an RTO of [duration] and an RPO of [duration]. The objectives are set by [role] with [business owner role], and are derived from [basis: customer commitments, contractual SLAs, business impact analysis]. They are reviewed [cadence] and on any material change to the offering's architecture or customer commitments. The review asks two questions: do these objectives still match what the business needs, and can the current capability actually meet them.

Replace with your practice. State real numbers per tier, name the basis, and name who signs off. An objective nobody can meet is worse than a longer objective you can.

Sample practice: backups aligned to the objectives¶

Sample text. Machine-based information resources are backed up by [mechanism] on a [frequency] schedule, with [retention] retention and copies held in [locations, including a second region or availability zone]. Backup coverage is reconciled against the asset inventory [cadence] so that a resource added to the environment does not sit outside the backup scope. Restore integrity is verified by [verification method] on a [cadence] sample. The reconciliation report states, per tier, the achieved recovery point against the declared RPO and flags any resource whose backup frequency cannot meet its tier's objective.

Replace with your practice. Name the mechanism, the frequency, the retention, and where copies live. The alignment claim in KSI-RPL-ABO is the comparison between achieved and declared, so make sure something produces that comparison.

Sample practice: the recovery plan¶

Sample text. The [Offering] recovery plan is held at [location] and covers: the recovery sequence by service tier and dependency order, the roles and the activation authority, the alternate processing and storage arrangements, the communications path to agency customers, and the criteria for declaring recovery complete. Each recovery procedure states the objective it serves and the elapsed time it has been observed to take, so a procedure that has drifted past its RTO is visible in the plan itself. The plan is reviewed [cadence] by [role], and after every recovery test and every actual recovery event.

Replace with your practice. Link the real plan. The alignment claim in KSI-RPL-ARP is between plan and objectives, so the plan needs to carry the objectives it serves rather than reference them elsewhere.

Sample practice: recovery testing¶

Sample text. Recovery capability is tested on a [cadence] schedule. The test program includes [test types: tabletop, functional exercise, full failover, restore-from-backup sampling], scoped so that every Tier 1 service is exercised at least [frequency]. Each test records the scenario, the participants, the measured recovery time and recovery point, the objectives they were compared against, the deficiencies found, and the corrective actions with owners and due dates. Corrective actions are tracked to closure through [tracking mechanism]. Tests that miss an objective trigger either a capability change or an objective change; the plan does not stay in a state where the test and the objective disagree.

Replace with your practice. Name the test types and cadence, and name where the after-test corrective actions are tracked. Recording the measured time against the objective is what makes the test evidence rather than an attendance record.

Organization-defined values¶

Evidence¶

The GRC-ITSM platform does not run your backups, hold your recovery plan, or execute your failover. It evidences that the four Recovery Planning indicators are being met, through scheduled machine checks and validation records. See the Continuous Monitoring and Reporting Policy and Procedures for the validation tree and the check cadences.

The recurring compliance task program already carries contingency plan functional exercise testing, contingency plan training, and the annual contingency plan review as scheduled tasks. Those tasks are where your test and review outcomes land as dated evidence.

Authority, review, and revision¶

Client fills. Name the executive who issues this document, the role that owns the recovery plan, the review cadence, and the approval path for exceptions to the objectives. Record the issue date and the revision history below.